Linux tcpdump and ngrep - Revision history

Pio2pio: /* ngrep */

2021-06-10T14:55:06Z

ngrep

@@ Line 66: / Line 66: @@
 # -p don't put the interface into promiscuous mode
 # -N show sub-protocol number along with single-character identifier (useful when observing raw or unknown protocols)
 </source>

2018-08-31T13:24:13Z

Expressions and | or logical operators

← Older revision		Revision as of 15:24, 31 August 2018
Line 4:		Line 4:
	sudo tcpdump -q -i any host 97.22.22.22		sudo tcpdump -q -i any host 97.22.22.22
	</source>		</source>
	== Expressions and \| or logical operators ==		== Expressions and/or logical operators ==
	<source lang="bash">		<source lang="bash">
	tcpdump -qn -i any -p -e "(dst port 9443 or \		tcpdump -qn -i any -p -e "(dst port 9443 or \

2018-08-31T13:23:47Z

Usage of expressions and | or with subnets

← Older revision		Revision as of 15:23, 31 August 2018
Line 4:		Line 4:
	sudo tcpdump -q -i any host 97.22.22.22		sudo tcpdump -q -i any host 97.22.22.22
	</source>		</source>
	== ~~Usage of expressions~~ and \| or ~~with subnets~~ ==		== Expressions and \| or logical operators ==
	<source lang="bash">		<source lang="bash">
	tcpdump -qn -i any -p -e "(dst port 9443 or \		tcpdump -qn -i any -p -e "(dst port 9443 or \

2018-08-31T13:22:11Z

tcpdump

← Older revision		Revision as of 15:22, 31 August 2018
Line 1:		Line 1:
	= tcpdump =		= tcpdump =
			== Filter a host ==
			<source lang="bash">
			sudo tcpdump -q -i any host 97.22.22.22
			</source>
	== Usage of expressions and \| or with subnets ==		== Usage of expressions and \| or with subnets ==
	<source lang="bash">		<source lang="bash">
	tcpdump -qn -i any -p -e "(dst port 9443 or dst port 22 or dst port 8672) \		tcpdump -qn -i any -p -e "(dst port 9443 or \
	~~and~~ (src net 10.34.96.128/25 or src net 10.34.97.128/25 or net 10.34.98.128/25)"		dst port 22 or \
	tcpdump -qn -i any -p -e "dst port 22 \		dst port 8672) and \
	and (src net 10.34.96.128/25 or src net 10.34.97.128/25 or net 10.34.98.128/25)"		(src net 10.34.96.128/25 or \
			src net 10.34.97.128/25 or \
			src net 10.34.98.128/25)"
			tcpdump -qn -i any -p -e "dst port 22 and (src net 10.34.96.128/25 or src net 10.34.97.128/25 or net 10.34.98.128/25)"
	# -q less verbose, -n no-dns, -e expression		# -q less verbose, -n no-dns, -e expression
	# -p (--no-promiscuous-mode) Don't put the interface into promiscuous mode		# -p (--no-promiscuous-mode) Don't put the interface into promiscuous mode

2018-08-31T11:24:30Z

Usage of expressions and | or with subnets

← Older revision		Revision as of 13:24, 31 August 2018
Line 6:		Line 6:
	tcpdump -qn -i any -p -e "dst port 22 \		tcpdump -qn -i any -p -e "dst port 22 \
	and (src net 10.34.96.128/25 or src net 10.34.97.128/25 or net 10.34.98.128/25)"		and (src net 10.34.96.128/25 or src net 10.34.97.128/25 or net 10.34.98.128/25)"
	# -q less verbose, -n no-dns, -p? -~~e expression~~		# -q less verbose, -n no-dns, -e expression
			# -p (--no-promiscuous-mode) Don't put the interface into promiscuous mode
	</source>		</source>

2018-08-18T08:56:52Z

ngrep

← Older revision		Revision as of 10:56, 18 August 2018
Line 13:		Line 13:


	~~install~~		Install
	<source lang="bash">		<source lang="bash">
	sudo apt install ngrep		sudo apt install ngrep
Line 45:		Line 45:
	......w[............................ !"#$%&'()*+,-./01234567 │		......w[............................ !"#$%&'()*+,-./01234567 │

			</source>


			<source lang="bash">
			sudo ngrep -q '.' 'host google.com' # match only traffic going to a particular destination site
			sudo ngrep -q '^GET .* HTTP/1.[01]' #monitor which files your browser is requesting
			sudo ngrep port 25 #destination port 25
			sudo ngrep -d any 'error' port 514 #monitor any network-based syslog traffic for the occurrence of the word “error”
			sudo ngrep port 80 #match all requests to the destination host
			sudo ngrep -W byline port 80 #match all requests to the destination host - prettier format
			sudo ngrep -t -W byline port 80 #print a timestamp when every packet is matched
			# -p don't put the interface into promiscuous mode
			# -N show sub-protocol number along with single-character identifier (useful when observing raw or unknown protocols)
	</source>		</source>

2018-08-18T08:47:33Z

ngrep

@@ Line 12: / Line 12: @@
 ''ngrep'' is network packet analyzer tool, It is a grep-like tool applied to the network layer – it matches traffic passing over a network interface with ''tcpdump'' like arguments syntax. It supports IPv4/6, TCP, UDP, ICMPv4/6, IGMP as well as Raw.
 <source lang="bash">
 sudo apt install ngrep
 sudo yum install ngrep
 sudo dnf install ngrep
 </source>

2018-08-18T08:31:33Z

Common examples of tcpdump

← Older revision		Revision as of 10:31, 18 August 2018
Line 1:		Line 1:
	= ~~Common examples of~~ tcpdump =		= tcpdump =
	== Usage of expressions and \| or with subnets ==		== Usage of expressions and \| or with subnets ==
	<source lang="bash">		<source lang="bash">

2018-08-18T08:31:07Z

Usage of expressions and | or with subnets

@@ Line 7: / Line 7: @@
    and (src net 10.34.96.128/25 or src net 10.34.97.128/25 or net 10.34.98.128/25)"
 # -q less verbose, -n no-dns, -p? -e expression
 </source>

2018-08-18T08:26:09Z

Pio2pio moved page Linux tcpdump to Linux tcpdump and ngrep without leaving a redirect: ngrep takes the same/ similar arguments as tcpdump

← Older revision	Revision as of 10:26, 18 August 2018
(No difference)